“It’s the same sort of breaches occurring again and again,” the ICO’s group manager for technology Simon Rice told The Guardian.

“There are some basics you should be doing. Clearly these are being done in a lot of places but [in many cases] there were a lot of basic things that could have been done, not necessarily to stop the breach but to make it more difficult for the attacker.”

In most breaches investigated by the ICO, emails and passwords went missing, which “although bad, isn’t that serious”, said Rice.

He pointed to the case of the Sony PlayStation Network breach of 2011, which led to the leakage of data on more than 71 million users. Sony was eventually fined £250,000. “Because there were so many people involved, it met that bar [deemed worthy of a fine],” Rice added.

The ICO can impose fines up to £500,000 for the most egregious breaches of the Data Protection Act, although that limit is set to increase. The largest fine yet handed out by the ICO was a £325,000 penalty for Brighton and Sussex University Hospitals NHS Trust, after patient data was found on hard drives sold on an online auction site.

While that is pocket change to those big businesses that have been guilty of letting data slip, the ICO believes that the reputational damage of a breach can cause a substantial amount of financial harm too.

In the US, the retail giant Target has shown its CEO and chief information officer the door, after a digital attack on the company’s point-of-sale systems in November 2013 led to the loss of more than 40 million customers’ credit card data.

The breach was also partly responsible for a 46% decline in fourth-quarter profits.

One of the mistakes highlighted in the ICO's report is failure to keep software up to date, a problem that has become even more urgent since Microsoft stopped supporting its Windows XP operating system in April. Many government departments and bodies, including the NHS, continue to use XP, placing them at greater risk of being hacked.

Rice said: “In general, the advice would be to move away from XP to a supported OS but the ICO will recognise that there are valid reasons which an organisation may not be able to do so and that an XP machine can be used with little or no risk to data protection with certain safeguards but these will need to be addressed on a case-by-case basis.”